Using an NP-complete problem to deter malicious clients

ABSTRACT

Methods and systems for using a challenge-response problem to deter malicious clients are described. A denial of a first login request for logging into an account by a computing device is detected. A second login request for logging into the account is received from the computing device. A reputation score for the second login request is determined based on the denial of the first login request. A number of terms for a challenge-response problem is set based on the determined reputation score. The challenge-response problem is configured to use the set number of terms and sent to the computing device. The second login request is authorized in response to verifying a second login credential and a solution to the challenge-response problem received from the computing device.

RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.15/857,172 filed Dec. 28, 2017, and entitled “Using An NP-CompleteProblem to Deter Malicious Clients,” which is incorporated herein byreference in its entirety

TECHNICAL FIELD

The subject technology generally relates to detecting bad actors andmore particularly, relates to a system and method that utilizes anondeterministic polynomial time-complete (NP-complete) problem to determalicious clients.

BACKGROUND

Over recent years, the volume of sensitive information transacted overthe internet has increased drastically. Various measures continue to betaken to improve the security of these transactions. One technique thatis widely used by hackers trying to compromise user accounts iscredential stuffing, where stolen account credentials are used to accessuser accounts through large-scale automated login requests directedagainst web applications. For example, account credentials (e.g.,username and password pairs) that have been stolen may be tried acrossdifferent websites and applications associated with differentorganizations. The likelihood that any individual stolen credential isthe actual username and password for an account of a particularorganization is low; however, by trying a large collection of stolencredentials across accounts of many different organizations, potentialusername and password matches may be discovered. This credentialstuffing technique is facilitated by modern computing power, wherenumerous usernames and passwords can be tried in a short amount of time.

While certain organizations are now requiring more robust passwords,such requirements aren't useful when stolen credentials are tried acrossa variety of different accounts. As such, alternative mechanisms forthwarting techniques such as credential stuffing are necessary to determalicious clients.

SUMMARY

According to various aspects of the subject technology, a system forusing a challenge-response problem to deter malicious clients isdescribed. A login attempt from a computing device with an associatedidentity profile is detected. A reputation score is determined based onthe identity profile, and a strength of a challenge-response problem foruse with the login attempt is set based on the determined reputationscore. The challenge-response problem with the set strength is then sentto the computing device. The login attempt is permitted to proceed whena solution to the challenge-response problem received from the computingdevice is verified.

According to various aspects of the subject technology, a method forusing a challenge-response problem to deter malicious clients isdescribed. A login attempt from a computing device is detected. If anidentity profile for the computing device does not exist, achallenged-response problem is set at a predetermined strength and sentto the computing device. If the identity profile does exist, areputation score is determined based on the identity profile, and astrength of a challenge-response problem for use with the login attemptis set based on the determined reputation score. The challenge-responseproblem with the set strength is then sent to the computing device. Thelogin attempt is permitted to proceed when a solution to thechallenge-response problem received from the computing device isverified. The login attempt is denied from proceeding when either awrong solution to the challenge-response problem is provided, or aresponse is not provided within a predetermined period of time.

According to various aspects of the subject technology, a non-transitorymachine-readable medium having stored thereon machine-readableinstructions executable to use a challenge-response problem to determalicious clients is described. A login attempt from a computing devicewith an associated identity profile is detected. A reputation score isdetermined based on the identity profile, and a strength of anNP-complete problem for use with the login attempt is set based on thedetermined reputation score. The NP-complete response problem with theset strength is then sent to the computing device. The login attempt ispermitted to proceed when a solution to the NP-complete problem receivedfrom the computing device is verified.

Additional features and advantages of the subject technology will be setforth in the description below, and in part will be apparent from thedescription, or may be learned by practice of the subject technology.The advantages of the subject technology will be realized and attainedby the structure particularly pointed out in the written description andclaims hereof as well as the appended drawings.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and areintended to provide further explanation of the invention as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are included to provide furtherunderstanding of the subject technology and are incorporated in andconstitute a part of this specification, illustrate aspects of thesubject technology and together with the description serve to explainthe principles of the subject technology.

FIG. 1 is a block diagram of an exemplary computing system on which adetermination of the legitimacy of clients using a challenge-responseproblem may be performed.

FIG. 2 is a block diagram of an exemplary computer system suitable forimplementing one or more devices of the computing system in FIG. 1 .

FIG. 3 illustrates an exemplary process 300 for using achallenge-response problem to determine the legitimacy of clients.

FIG. 4 provides an illustrative depiction of a credential stuffingattempt on a computing device within a network of computing devices.

DETAILED DESCRIPTION

Personal electronic devices (e.g., smartphones, desktops, tablets,laptops, etc.) are used for a variety of purposes including but notlimited to real-time communications, financial transactions, and thetransmission of or sharing of data. For these activities to be properlyconducted, a user must be authenticated to ensure that the user is whothe user claims to be. Numerous applications are now available for usersto connect to their accounts which contain sensitive information (e.g.,personal information, financial information, etc.). As a result, theseapplications that serve as gateways to sensitive information becometargets for unscrupulous activity.

One technique that is popular among hackers is credential stuffing,where hackers run programs (e.g., bot nets) that attempt large-scalelogin requests directed against web applications using stolen or evenmade-up credentials (e.g., username and password pairs). That is, botnets may simulate authentication requests via mobile devices that runnative applications of organizations. Hackers have also demonstrated theability to decompile instances of the native application, obtainembedded secrets, and duplicate the use of those secrets to escapedetection by previously-implemented efforts to distinguish attackersfrom legitimate clients. While tools such as reCaptcha have been used toprevent mass authentication requests, the use of tools like reCaptchamay cause friction in the login process and in turn may turn customersaway. Additionally, advancements in computing power has only made iteasier for hackers to try larger collections of credentials over ashorter period of time. Ultimately, through sheer brute force method,the greater the number of credentials that are tried, the more likely anindividual's account will be infiltrated.

Accordingly, one way to inhibit high-volume attacks by bot nets thatsend high rates of customer authentication requests where a servercannot rely on the secrecy of keys or algorithms built into legitimateclients to distinguish between legitimate clients and bot nets is toraise a client's computational cost of sending an authenticationrequest. Doing so would cause the potential hackers to have to spendmore resources to maintain their current attack volumes. Such amechanism will cause the hackers to either stop their attacks becausethey are no longer efficient or effective, or to switch to a differenttarget that does not carry such a cost. A legitimate client, however,will not likely be discouraged to pay the computational cost since thesuccess rate of the client's authentication request is high incomparison to requests made by bot nets. In other words, a legitimateclient would only have to pay the cost once per login attempt (assumingthe attempt is successful), whereas a bot net will pay the cost for eachof the many attempts (an extremely high percentage which areunsuccessful).

In order for this approach to work, however, several criteria must besatisfied: 1) that the client paid the cost must be verifiable; 2) thereis an easy way to vary the cost imposed on the client in accordance tochanging circumstances, without requiring changes to the implementationof legitimate clients; 3) the cost to verify the client's payment isconsiderably less than the cost borne by the client in responding to thechallenge; and 4) a fine-grained control over the cost imposed on theclient is provided. Accordingly, an NP-complete problem that requiresthe client to solve it within a bounded period of time makes for asuitable protocol.

Using this protocol, a server may generate a random instance ofNP-complete problem that is presented to the client. Furthermore, theserver is able to control the cost by altering the number of terms inthe NP-complete problem. Using subset-sum as an example NP-completeproblem, increasing the number of terms (i.e., increasing the robustnessof the problem) causes a linear increase in the server's cost togenerate the problem and to verify the challenge, while causing anexponential increase in the client's cost to properly respond to thechallenge. In other words, it would be much less costly for the serverto verify that the challenge has been met than it would be to actuallycomplete the challenge on the client side. Other NP-complete problemsmight, however, require super-linear time to generate an arbitraryinstance known to have a solution.

This specification includes references to “one embodiment,” “someembodiments,” or “an embodiment.” The appearances of these phrases donot necessarily refer to the same embodiment. Particular features,structures, or characteristics may be combined in any suitable mannerconsistent with this disclosure.

“First,” “Second,” etc. As used herein, these terms are used as labelsfor nouns that they precede, and do not necessarily imply any type ofordering (e.g., spatial, temporal, logical, cardinal, etc.).Furthermore, various components may be described or claimed as“configured to” perform a task or tasks. In such contexts, “configuredto” is used to connote structure by indicating that the componentsinclude structure (e.g., stored logic) that performs the task or tasksduring operation. As such, the component can be said to be configured toperform the task even when the component is not currently operational(e.g., is not on). Reciting that a component is “configured to” performone or more tasks is expressly intended not to invoke 35 U.S.C. § 112(f)for that component.

FIG. 1 is a block diagram of an exemplary computing system on which adetermination of the legitimacy of clients using a challenge-responseproblem may be performed. As shown, a computing system 100 may compriseor implement a plurality of servers, devices, and/or software componentsthat operate to perform various methodologies in accordance with thedescribed embodiments. Exemplary servers, devices, and/or softwarecomponents may include, for example, stand-alone and enterprise-classservers running an operating system (OS) such as a MICROSOFT® OS, aUNIX® OS, a LINUX® OS, or other suitable OS. It may be appreciated thatthe servers illustrated in FIG. 1 may be deployed in other ways and thatthe operations performed and/or the services provided by such serversmay be combined, distributed, and/or separated for a givenimplementation and may be performed by a greater number or fewer numberof servers. One or more servers may be operated and/or maintained by thesame or different entities.

Computing system 100 may include, among various devices, servers,databases and other elements, one or more clients 102 comprising oremploying one or more client devices 104, such as a laptop, a mobilecomputing device, a tablet, a personal computer, a wearable device,and/or any other computing device having computing and/or communicationscapabilities in accordance with the described embodiments. Clientdevices 104 may include a cellular telephone, smart phone, electronicwearable device (e.g., smart watch, virtual reality headset), or othersimilar mobile devices that a user may carry on or about his or herperson and access readily.

Client devices 104 generally may provide one or more client programs106, such as system programs and application programs to perform variouscomputing and/or communications operations. Exemplary system programsmay include, without limitation, an operating system (e.g., MICROSOFT®OS, UNIX® OS, LINUX® OS, Symbian OS™, iOS, Android, Embedix OS, BinaryRun-time Environment for Wireless (BREW) OS, JavaOS, a WirelessApplication Protocol (WAP) OS, and others), device drivers, programmingtools, utility programs, software libraries, application programminginterfaces (APIs), and so forth. Exemplary application programs mayinclude, without limitation, a payment system application, a web browserapplication, messaging application, contacts application, calendarapplication, electronic document application, database application,media application (e.g., music, video, television), location-basedservices (LBS) application (e.g., GPS, mapping, directions, positioningsystems, geolocation, point-of-interest, locator) that may utilizehardware components such as an antenna, and so forth. One or more ofclient programs 106 may display various graphical user interfaces (GUIs)to present information to and/or receive information from one or moreusers of client devices 104. In some embodiments, client programs 106may include one or more applications configured to conduct some or allof the functionalities and/or processes discussed below.

As shown, client devices 104 may be communicatively coupled via one ormore networks 108 to a network-based system 110. Network-based system110 may be structured, arranged, and/or configured to allow client 102to establish one or more communications sessions between network-basedsystem 110 and various client devices 104 and/or client programs 106.Accordingly, a communications session between client devices 104 andnetwork-based system 110 may involve the unidirectional and/orbidirectional exchange of information and may occur over one or moretypes of networks 108 depending on the mode of communication. While theembodiment of FIG. 1 illustrates a computing system 100 deployed in aclient-server operating environment, it is to be understood that othersuitable operating environments and/or architectures may be used inaccordance with the described embodiments.

Data communications between client devices 104 and the network-basedsystem 110 may be sent and received over one or more networks 108 suchas the Internet, a WAN, a WWAN, a WLAN, a mobile telephone network, alandline telephone network, personal area network, as well as othersuitable networks. For example, client devices 104 may communicate withnetwork-based system 110 over the Internet or other suitable WAN bysending and or receiving information via interaction with a website,e-mail, IM session, and/or video messaging session. Any of a widevariety of suitable communication types between client devices 104 andsystem 110 may take place, as will be readily appreciated. Inparticular, wireless communications of any suitable form (e.g.,Bluetooth, near-field communication, etc.) may take place between clientdevice 104 and system 110, such as that which often occurs in the caseof mobile phones or other personal and/or mobile devices.

Network-based system 110 may comprise one or more communications servers120 to provide suitable interfaces that enable communication usingvarious modes of communication and/or via one or more networks 108.Communications servers 120 may include a web server 122, an API server124, and/or a messaging server 126 to provide interfaces to one or moreapplication servers 130. Application servers 130 of network-based system110 may be structured, arranged, and/or configured to provide variousonline services to client devices that communicate with network-basedsystem 110. In various embodiments, client devices 104 may communicatewith application servers 130 of network-based system 110 via one or moreof a web interface provided by web server 122, a programmatic interfaceprovided by API server 124, and/or a messaging interface provided bymessaging server 126. It may be appreciated that web server 122, APIserver 124, and messaging server 126 may be structured, arranged, and/orconfigured to communicate with various types of client devices 104,and/or client programs 106 and may interoperate with each other in someimplementations.

Web server 122 may be arranged to communicate with web clients and/orapplications such as a web browser, web browser toolbar, desktop widget,mobile widget, web-based application, web-based interpreter, virtualmachine, mobile applications, and so forth. API server 124 may bearranged to communicate with various client programs 106 comprising animplementation of API for network-based system 110. Messaging server 126may be arranged to communicate with various messaging clients and/orapplications such as e-mail, IM, SMS, MMS, telephone, VoIP, videomessaging, IRC, and so forth, and messaging server 126 may provide amessaging interface to enable access by client 102 to the variousservices and functions provided by application servers 130.

Application servers 130 of network-based system 110 may be servers thatprovide various services to client devices, such as tools forauthenticating users and associated libraries. Application servers 130may include multiple servers and/or components. For example, applicationservers 130 may include a challenge problem generator 132, profileupdate engine 134, reputation determination engine 136, and/orauthentication engine 138. These servers and/or components, which may bein addition to other servers, may be structured and arranged to identifythose webpages that malicious content.

Application servers 130, in turn, may be coupled to and capable ofaccessing one or more databases 140 including system call database 142,application database 144, and/or authentication database 146. Databases140 generally may store and maintain various types of information foruse by application servers 130 and may comprise or be implemented byvarious types of computer storage devices (e.g., servers, memory) and/ordatabase structures (e.g., relational, object-oriented, hierarchical,dimensional, network) in accordance with the described embodiments.

FIG. 2 illustrates an exemplary computer system 200 in block diagramformat suitable for implementing on one or more devices of the computingsystem in FIG. 1 . In various implementations, a device that includescomputer system 200 may comprise a personal computing device (e.g., asmart or mobile phone, a computing tablet, a personal computer, laptop,wearable device, PDA, etc.) that is capable of communicating with anetwork. A service provider and/or a content provider may utilize anetwork computing device (e.g., a network server) capable ofcommunicating with the network. It should be appreciated that each ofthe devices utilized by users, service providers, and content providersmay be implemented as computer system 200 in a manner as follows.Additionally, as more and more devices become communication capable,such as smart devices using wireless communication to report, track,message, relay information and so forth, these devices may be part ofcomputer system 200.

Computer system 200 may include a bus 202 or other communicationmechanisms for communicating information data, signals, and informationbetween various components of computer system 200. Components include aninput/output (I/O) controller 204 that processes a user action, such asselecting keys from a keypad/keyboard, selecting one or more buttons,links, actuatable elements, etc., and sends a corresponding signal tobus 202. I/O controller 204 may also include an output component, suchas a display 206 and a cursor control 208 (such as a keyboard, keypad,mouse, touchscreen, etc.). In some examples, I/O controller 204 mayinclude an image sensor for capturing images and/or video, such as acomplementary metal-oxide semiconductor (CMOS) image sensor, and/or thelike. An audio I/O component 210 may also be included to allow a user touse voice for inputting information by converting audio signals. AudioI/O component 210 may allow the user to hear audio.

A transceiver or network interface 212 transmits and receives signalsbetween computer system 200 and other devices, such as another userdevice, a merchant server, an email server, application serviceprovider, web server, a payment provider server, and/or other serversvia a network. In various embodiments, such as for many cellulartelephone and other mobile device embodiments, this transmission may bewireless, although other transmission mediums and methods may also besuitable. A processor 214, which may be a micro-controller, digitalsignal processor (DSP), or other processing component, processes thesevarious signals, such as for display on computer system 200 ortransmission to other devices over a network 216 via a communicationlink 218. Again, communication link 218 may be a wireless communicationin some embodiments. Processor 214 may also control transmission ofinformation, such as cookies, IP addresses, images, and/or the like toother devices.

Components of computer system 200 also include a system memory 220(e.g., RAM), a static storage component 222 (e.g., ROM), and/or a diskdrive 224. Computer system 200 performs specific operations by processor214 and other components by executing one or more sequences ofinstructions contained in system memory 220. Logic may be encoded in acomputer-readable medium, which may refer to any medium thatparticipates in providing instructions to processor 214 for execution.Such a medium may take many forms, including but not limited to,non-volatile media, volatile media, and/or transmission media. Invarious implementations, non-volatile media includes optical or magneticdisks, volatile media includes dynamic memory such as system memory 220,and transmission media includes coaxial cables, copper wire, and fiberoptics, including wires that comprise bus 202. In one embodiment, thelogic is encoded in a non-transitory machine-readable medium. In oneexample, transmission media may take the form of acoustic or lightwaves, such as those generated during radio wave, optical, and infrareddata communications.

Some common forms of computer readable media include, for example,floppy disk, flexible disk, hard disk, magnetic tape, any other magneticmedium, CD-ROM, any other optical medium, punch cards, paper tape, anyother physical medium with patterns of holes, RAM, PROM, EPROM,FLASH-EPROM, any other memory chip or cartridge, or any other mediumfrom which a computer is adapted to read.

In various embodiments of the present disclosure, execution ofinstruction sequences to practice the present disclosure may beperformed by computer system 200. In various other embodiments of thepresent disclosure, a plurality of computer systems 200 coupled bycommunication link 218 to the network (e.g., such as a LAN, WLAN, PTSN,and/or various other wired or wireless networks, includingtelecommunications, mobile, and cellular phone networks) may performinstruction sequences to practice the present disclosure in coordinationwith one another. Modules described herein may be embodied in one ormore computer readable media or be in communication with one or moreprocessors to execute or process the techniques and algorithms describedherein.

A computer system may transmit and receive messages, data, informationand instructions, including one or more programs (i.e., applicationcode) through a communication link and a communication interface.Received program code may be executed by a processor as received and/orstored in a disk drive component or some other non-volatile storagecomponent for execution.

Where applicable, various embodiments provided by the present disclosuremay be implemented using hardware, software, or combinations of hardwareand software. Also, where applicable, the various hardware componentsand/or software components set forth herein may be combined intocomposite components comprising software, hardware, and/or both withoutdeparting from the spirit of the present disclosure. Where applicable,the various hardware components and/or software components set forthherein may be separated into sub-components comprising software,hardware, or both without departing from the scope of the presentdisclosure. In addition, where applicable, it is contemplated thatsoftware components may be implemented as hardware components andvice-versa.

Software, in accordance with the present disclosure, such as programcode and/or data, may be stored on one or more computer-readable media.It is also contemplated that software identified herein may beimplemented using one or more computers and/or computer systems,networked and/or otherwise. Such software may be stored and/or used atone or more locations along or throughout the system, at client 102,network-based system 110, or both. Where applicable, the ordering ofvarious steps described herein may be changed, combined into compositesteps, and/or separated into sub-steps to provide features describedherein.

The foregoing networks, systems, devices, and numerous variationsthereof may be used to implement one or more services, such as theservices discussed above and in more detail below.

FIG. 3 illustrates an exemplary process 300 for using achallenge-response problem to determine the legitimacy of clients. Atoperation 310 the system detects a login attempt with an associatedidentity profile. A login attempt may be detected as a user navigatingto a login screen with a browser, or the user initiating an app on asmartphone, tablet or other computing device, and providing logincredentials such as a username and password. The login attempt may alsobe associated with an identity profile. For example, the system maybuild an identity profile specific to a computing device. That is, theidentity profile may be associated with a unique identifier of thecomputing device.

In some embodiments, the identity profile is built based on historicaldata associated with the computing device. For example, the identityprofile may include information such past logins into an application,and the type of transactions conducted once logged in. The identityprofile may further include information such as the internet protocol(IP) address associated with the computing device. Additionally, theidentity profile may keep track of the users that have logged into theapplication from the computing device, and a log of the login attempts,e.g., whether the user is able to log in successfully on the firstattempt, or if the user needed multiple login attempts to be successful.

In operation 320, a reputation score for the computing device isdetermined based on the identity profile. For example, if the identityprofile indicates that the computing device has been regularly used inthe past to log into the application, the effect on the reputation wouldbe positive because the computing device is presumably known to theapplication. Other factors such as the timing of the previous logins mayalso contribute to reputation. For instance, if the identity profileindicates that a computing device has not logged into the applicationfor longer than a predetermined period of time, reputation of thatidentity profile may take a hit as the assumption is that the computingdevice may not be as familiar, and thus safe, as it once was.Furthermore, any indications within the identity profile that thecomputing device is departing from normal or expected use may adverselyaffect the reputation. In other words, different styles of uses of thecomputing device indicating different behaviors may contribute todetermining the riskiness of the computing device, and thus contributeto the reputation.

Based on the reputation, a corresponding strength of achallenge-response for use with the login attempt may be set in step330. In a preferred embodiment, the challenge-response may be anNP-complete problem. In some embodiments, the NP-complete problem is asubset sum problem. While the NP-complete problem is well known, the useof the NP-complete problem described herein is unusual orunconventional, and has not been contemplated as a mechanism forenhancing the security of an authentication process in the mannerdescribed below. The characteristics of the NP-complete problem makes itparticularly useful because of the unique results that it produces.

In an NP-complete problem, the cost of solving the problem may be madedisproportionally high when compared to the cost of generating andverifying the problem. In other words, the main characteristic of anNP-complete problem is that the problem is much more costly to solvethan to generate and verify. While an increase in the number of terms(i.e., increasing the robustness of the problem) in an NP-completeproblem causes a linear increase in the server's cost to generate andverify the challenge, the same increase causes an exponential increasein the client's cost to properly respond to the challenge. In otherwords, it would be much less costly for the server to generate thechallenge and verify that the challenge has been met than it would be toactually complete the challenge on the client side.

A strength of challenge may be indicated by an integer. The timerequired to solve the problem increases very quickly as the size of theproblem grows. As such, the strength of the challenge-responsecorresponds to the size of the problem. A higher strengthchallenge-response is one that has a larger problem that requires ahigher cost to solve. Conversely, a lower strength challenge-response isone that has a smaller problem, and is thus easier to solve. Forexample, a strength of 20 may require a computing device seekingauthentication to perform close to a million operations (i.e.,2²⁰=1,048,576 operations), whereas the system will only need 20operations to verify whether the response is correct or not. Increasingthe strength by one will double the number of operations required of thecomputing device, but only increase the verification process by oneoperation.

An adjustability factor may be used by the system may change thestrength of the challenge-response in accordance to the determinedreputation. That is, if the computing device has a good reputation basedon the identity profile, the system may present a lower strengthchallenge-response (i.e., a smaller NP-complete problem) that requiresless time to solve because the computing device is identified as beinglower risk. Conversely, if the computing device has a bad reputationbased on the identity profile (i.e., higher risk), then a higherstrength challenge-response (i.e., a larger NP-complete problem) may bepresented. This logic suggests that computing devices identified ashaving questionable reputation have a higher likelihood of performing anattack. Accordingly, to discourage attacks such as credential stuffingfrom occurring on the application, the system increases thecomputational cost of logging on. Thus, hackers attempting to stuff thecredentials to determine if any of the credentials work are met withchallenges that are computationally expensive.

While the risk of a legitimate user being presented with a largerNP-complete problem is not insignificant, the additional cost to theuser in this situation will be mostly imperceptible because the userwill provide a proper username and password pair, typically on a firstlogin attempt. Credential stuffers, on the other hand, will bechallenged with an NP-complete problem each time a credential isentered. Thus, if the credential stuffer is attempting to try 10,000username-password pairs on an application, and each NP-complete problemrequires an average of two seconds of computational cost, then theattempt would require roughly 2 hours and 45 minutes in order to try allthe username-password pairs. A two second computational cost for alegitimate user, however, would hardly be noticeable and create minimalfriction in the user experience.

Once a strength of the challenge-response is set, the challenge-responseis sent back to the computing device in operation 340. The system thenwaits for a response to the challenge from the computing device. Once aresponse is received, the system determines whether the response isvalid. As discussed, validating the response is a much less costlyoperation than determining a valid response. As such, the system maydetermine whether the response is valid in an expeditious manner so asnot to cause a prolonged delay. Once the challenge-response has beenvalidated, the login attempt is permitted to proceed in operation 350,assuming that the credentials provided are valid. If the credentials arenot valid, the login attempt is rejected.

In some instances, entering invalid credentials will be recorded in theidentity profile, which will in turn cause a negative effect to thereputation score of the identity profile. The negative effect may growfor each wrongly entered set of credentials. That is, the first time awrong username and password is entered, a minimal negative effect mayresult, but repeated entries of incorrect credentials will cause eachinstance of the negative effect to increase (e.g., repeated invalidtries may suggest that a bad actor is credential stuffing).

In some embodiments, the computing device may be provided with apredetermined amount of time to respond to the challenge. If thecomputing device does not respond within the time provided, the resultswill also be recorded in the identity profile, and thereby cause adetriment to the reputation score. By limiting the amount of time thecomputing device has to respond, the server may close out operationswhen the computing device is determined to be non-responsive, and thusconserve resources.

Additionally, providing a wrong answer to the challenge-response problemwill also negatively affect the reputation score. A wrong response willalso be recorded in the identity profile. In a preferred embodiment, awrong response is viewed more negatively than no response at all, andthus will more severely harm to the reputation score as compared tonon-responsiveness.

In some embodiments, the system may determine the computing capabilitiesof the computing device and adjust the strength of thechallenge-response accordingly. For example, if the CPU of the computingdevice is detected to run at a slower speed (e.g., a mobile device maynot have as much processing power as a desktop computer), the system maylower the strength of the challenge-response so that, in the even alegitimate user is attempting to log in, the computing device is notoverwhelmed with its attempt to respond to the challenge. Likewise, ifthe computing device is detected to run at faster speeds, thechallenge-response may be raised to a higher strength with a largerproblem so as to not make a correct response too easily determinable. Insome instances, the system is provided with a predetermined targetresponse time (e.g., three seconds). The system may adjust the strengthof the challenge-response based on the detected computing power to hitthe target response time. In other words, the system may attempt to makethe expected time it takes to respond to a challenge universal acrossall platforms the same, and adjusts the strength of thechallenge-response to match the computing power of the computing device.

In some embodiments, a computing device may not have an identity profilebecause the computing device is being used to for a first time. In theseinstances, the computing device may be put on probation initially, andthe challenge is applied indiscriminately. That is, a standard challengeis presented to the computing device until enough data has beencollected to build the identity profile and thereby cause an adjustmentin the reputation of that computing device. Issuing a default challengewhen no information about a computing device is known may neutralizeattempts by bad actors to circumvent the challenge by claiming therequest is coming from a new device with each login try.

In some embodiments, when a computing device is determined to be a badactor (e.g., known to have been previously used for credentialstuffing), the system may present a challenge-response at a strengththat takes and inordinate amount of time to solve. A blacklist ofcomputing device identifiers or IP address may be used to facilitatethis determination of bad actors. Additionally, the system may detectthe environment from which the application requests is coming. Forexample, an application determined to be operating in a debuggerenvironment on the computing device may cause a red flag to be raised,suggesting the computing device is a bad actor. As such, the computingdevice will be presented with a high strength challenge-response. Thesystem may further maintain a library of tamper detectors that iscontinuously updated with known tamper techniques and protocols fordetecting those techniques.

In some embodiments, the task being requested may be considered indetermining the strength of the challenge-response presented to thecomputing device. For example, attempted logins to a financialinstitution is clearly an activity that requires the highest security.Thus, a higher strength of the challenge-response will be utilized. Onthe other hand, if an attempted authentication is for an applicationthat does not store or use any sensitive information, then a lowerstrength of the challenge-response is used. The use of thechallenge-response is directed at increasing the computational cost forpotential credential stuffing hackers. Accordingly, applications thatare known targets for such infiltration tactics may adopt a higherstrength challenge-response from the outset and only adjust downwardwhen a computing device has proven to be reputably safe.

FIG. 4 provides an illustrative depiction of a credential stuffingattempt on a computing device within a network of computing devices. Alist of compromised credentials 405 is used to attempt logins on anapplication 410 running on a computing device. The application iscommunicatively coupled to an application server 415 via a networkconnecting the computing device to the application server 415.

In this example, the username 420 and password 425 pairs areindividually tried in the username entry box 430 and password entry box435 on the application 410. When the application 410 attempts a login onthe application server 415, however, a challenge-response problem ispresented by the application server 415 back to the application 410 forthe computing device to complete before the login is permitted. Thus,for each username 420 and password 425 pair that is tried, there's anassociated computational cost to the attempted login because of thechallenge-response problem. As the number of username 420 and password425 pairs grows, so does the cumulative cost of the challenge-response.For example, if there are 100,000 username 420 and password 425 pairs(i.e., n=100,000), the cost to the computing device to try every pairwould be 100,000 multiplied by the computational cost required by thechallenge-response problem.

Additionally, as discussed above, the strength of the challenge-responseproblem can be adjusted to accommodate a detected situation. If, forexample, multiple attempts are received from a particular computingdevice or from a single IP address, the application server may, upondetecting such a behavior, increase the strength of thechallenge-response problem to make it increasingly more costly for thecomputing device to process each additional attempt. Using andNP-complete problem, there is no limit as to how high the strength ofthe problem can be raised. Ostensibly, the server can send the computingdevice (or whatever device is attempting the logins) on a “wild goosechase” when a bad actor is discovered. Thus, rather than flat outdenying access to the bad actor, the server may attempt to occupy theresources of the computing device used by the bad actor by issuing achallenge that requires a large amount of computational resources, andrepeatedly issuing such a challenge even if the bad actor has respondedcorrectly.

Since hackers using techniques like credential stuffing rely on theability to try a large number of credentials in a short period of time,slowing down the process of entering credentials with achallenge-response problem will create a bottleneck in the hackingprocess that may lead the hackers to ultimately abandon their attempts.If, hypothetically speaking, one out of 10,000 credentials tried issuccessful, then an average of 10,000 login attempts would be needed toinfiltrate one account. Thus, by challenging the process in a mannerwhere trying a large amount of credentials on an application would takean inordinate amount of time, hackers will be discouraged from trying tocompromise the application.

The user device (i.e., the computing device) described above may be oneof a variety of devices including but not limited to a smartphone, atablet, a laptop and a pair of augmented reality spectacles. Each ofthese devices embodies some processing capabilities and an ability toconnect to a network (e.g., the internet, a LAN, a WAN, etc.). Eachdevice also includes a display element for displaying a variety ofinformation. The combination of these features (display element,processing capabilities and connectivity) on the mobile communicationsenables a user to perform a variety of essential and useful functions.

The foregoing description is provided to enable a person skilled in theart to practice the various configurations described herein. While thesubject technology has been particularly described with reference to thevarious figures and configurations, it should be understood that theseare for illustration purposes only and should not be taken as limitingthe scope of the subject technology.

There may be many other ways to implement the subject technology.Various functions and elements described herein may be partitioneddifferently from those shown without departing from the scope of thesubject technology. Various modifications to these configurations willbe readily apparent to those skilled in the art, and generic principlesdefined herein may be applied to other configurations. Thus, manychanges and modifications may be made to the subject technology, by onehaving ordinary skill in the art, without departing from the scope ofthe subject technology.

It is understood that the specific order or hierarchy of steps in theprocesses disclosed is an illustration of exemplary approaches. Basedupon design preferences, it is understood that the specific order orhierarchy of steps in the processes may be rearranged. Some of the stepsmay be performed simultaneously. The accompanying method claims presentelements of the various steps in a sample order, and are not meant to belimited to the specific order or hierarchy presented.

A phrase such as “an aspect” does not imply that such aspect isessential to the subject technology or that such aspect applies to allconfigurations of the subject technology. A disclosure relating to anaspect may apply to all configurations, or one or more configurations.An aspect may provide one or more examples of the disclosure. A phrasesuch as an “aspect” may refer to one or more aspects and vice versa. Aphrase such as an “implementation” does not imply that suchimplementation is essential to the subject technology or that suchimplementation applies to all configurations of the subject technology.A disclosure relating to an implementation may apply to allimplementations, or one or more implementations. An implementation mayprovide one or more examples of the disclosure. A phrase such an“implementation” may refer to one or more implementations and viceversa. A phrase such as a “configuration” does not imply that suchconfiguration is essential to the subject technology or that suchconfiguration applies to all configurations of the subject technology. Adisclosure relating to a configuration may apply to all configurations,or one or more configurations. A configuration may provide one or moreexamples of the disclosure. A phrase such as a “configuration” may referto one or more configurations and vice versa.

Furthermore, to the extent that the terms “include,” “have,” and “thelike” are used in the description or the claims, such terms are intendedto be inclusive in a manner similar to the term “comprise” as “comprise”is interpreted when employed as a transitional word in a claim.

The word “exemplary” is used herein to mean “serving as an example,instance, or illustration.” Any implementation described herein as“exemplary” is not necessarily to be construed as preferred oradvantageous over other implementations.

A reference to an element in the singular is not intended to mean “oneand only one” unless specifically stated, but rather “one or more.” Theterm “some” refers to one or more. All structural and functionalequivalents to the elements of the various configurations describedthroughout this disclosure that are known or later come to be known tothose of ordinary skill in the art are expressly incorporated herein byreference and intended to be encompassed by the subject technology.Moreover, nothing disclosed herein is intended to be dedicated to thepublic regardless of whether such disclosure is explicitly recited inthe above description.

What is claimed is:
 1. A system for authenticating a user, comprising: anon-transitory memory storing instructions; and one or more hardwareprocessors coupled to the non-transitory memory and configured toexecute the instructions to cause the system to perform operationscomprising: detecting a denial of a first login request for logging intoan account by a computing device, wherein the denial of the first loginrequest is based on a first solution to a first challenge-responseproblem received from the computing device, and wherein the firstchallenge-response problem is based on a first reputation scoredetermined for the first login request; receiving, from the computingdevice, a second login request for logging into the account; determininga second reputation score for the second login request based on thefirst reputation score and the denial of the first login request;setting a number of terms for a second challenge-response problem basedon the second reputation score, wherein the second challenge-responseproblem uses the number of terms; sending the second challenge-responseproblem to the computing device; and authorizing the second loginrequest in response to verifying a login credential and a secondsolution to the second challenge-response problem received from thecomputing device.
 2. The system of claim 1, wherein at least one of thefirst challenge-response problem or the second challenge-responseproblem is an NP-complete problem.
 3. The system of claim 1, wherein thedenial of the first login request is further based on an entry ofincorrect credentials.
 4. The system of claim 1, wherein the computingdevice has an associated identity profile that includes historical dataof logins of the computing device, the historical data including one ormore internet protocol (IP) addresses associated with the computingdevice, one or more types of transactions conducted by the computingdevice, and a log of one or more login attempts made through thecomputing device.
 5. The system of claim 4, wherein the secondreputation score for the second login request is determined furtherbased on the identity profile.
 6. The system of claim 1, wherein theoperations further comprise determining a computing power of thecomputing device, wherein the setting the number of terms for the secondchallenge-response problem is further based on the determined computingpower.
 7. The system of claim 1, wherein the operations further comprisedetermining a type of application from which the second login request isreceived, wherein the setting the number of terms for the secondchallenge-response problem is further based on the determined type ofapplication.
 8. A method comprising: detecting a denial of a first loginrequest for logging into an account by a computing device, wherein thedenial of the first login request is based on a first solution to afirst challenge-response problem received from the computing device, andwherein the first challenge-response problem is based on a firstreputation score determined for the first login request; receiving, byone or more hardware processors associated with a computing system, asecond login request for logging into the account from the computingdevice; determining, by the one or more hardware processors, a secondreputation score for the second login request based on the firstreputation score and the denial of the first login request; setting anumber of terms for a second challenge-response problem based on thesecond reputation score; configuring, by the one or more hardwareprocessors, the second challenge-response problem to use the number ofterms; sending the second challenge-response problem to the computingdevice; and authorizing, by the one or more hardware processors, thesecond login request in response to verifying a login credential and asecond solution to the second challenge-response problem received fromthe computing device.
 9. The method of claim 8, wherein the secondchallenge-response problem is an NP-complete problem.
 10. The method ofclaim 8, wherein the denial of the first login request is further basedon an entry of incorrect credentials.
 11. The method of claim 8, whereinthe computing device has an associated identity profile that includeshistorical data of logins of the computing device, the historical dataincluding one or more internet protocol (IP) addresses associated withthe computing device, one or more types of transactions conducted by thecomputing device, and a log of one or more login attempts made throughthe computing device.
 12. The method of claim 11, wherein the secondreputation score for the second login request is determined furtherbased on the identity profile.
 13. The method of claim 8, furthercomprising determining a computing power of the computing device,wherein the setting the number of terms for the secondchallenge-response problem is further based on the determined computingpower.
 14. The method of claim 8, further comprising determining a typeof application from which the second login request is received, whereinthe setting the number of terms for the second challenge-responseproblem is further based on the determined type of application.
 15. Anon-transitory machine-readable medium having stored thereonmachine-readable instructions executable to cause a machine to performoperations comprising: detecting a denial of a first login request forlogging into an account by a computing device, wherein the denial of thefirst login request is based on a first solution to a firstchallenge-response problem received from the computing device, andwherein the first challenge-response problem is based on a firstreputation score determined for the first login request; receiving, fromthe computing device, a second login request for logging into theaccount; determining a second reputation score for the second loginrequest based on the first reputation score and the denial of the firstlogin request; setting a number of terms for a second challenge-responseproblem based on the second reputation score, wherein the secondchallenge-response problem uses the number of terms; sending the secondchallenge-response problem to the computing device; and authorizing thesecond login request in response to verifying a login credential and asecond solution to the second challenge-response problem received fromthe computing device.
 16. The non-transitory machine-readable medium ofclaim 15, wherein the second challenge-response problem is anNP-complete problem.
 17. The non-transitory machine-readable medium ofclaim 15, wherein the denial of the first login request is further basedon an entry of incorrect credentials.
 18. The non-transitorymachine-readable medium of claim 15, wherein the computing device has anassociated identity profile that includes historical data of logins ofthe computing device, the historical data including one or more internetprotocol (IP) addresses associated with the computing device, one ormore types of transactions conducted by the computing device, and a logof one or more login attempts made through the computing device, andwherein the second reputation score for the second login request isdetermined further based on the identity profile.
 19. The non-transitorymachine-readable medium of claim 15, wherein the operations furthercomprise determining a computing power of the computing device, whereinthe setting the number of terms for the second challenge-responseproblem is further based on the determined computing power.
 20. Thenon-transitory machine-readable medium of claim 15, wherein theoperations further comprise determining a type of application from whichthe second login request is received, wherein the setting the number ofterms for the second challenge-response problem is further based on thedetermined type of application.